fix(selectors): harden exact reference handling

Author: Bill Leoutsakos

apps/sim/lib/environment/utils.test.ts

@@ -54,6 +54,7 @@ import {
   getExecutionEnvironment,
   getPersonalAndWorkspaceEnv,
   invalidateEffectiveDecryptedEnvCache,
+  resolveEffectiveEnvironmentVariables,
   upsertWorkspaceEnvVars,
   WorkspaceEnvAccessError,
 } from '@/lib/environment/utils'
@@ -175,6 +176,172 @@ describe('getEffectiveEnvironmentVariableNames', () => {
   })
 })
 
+describe('resolveEffectiveEnvironmentVariables', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+    invalidateEffectiveDecryptedEnvCache({ userId: 'resolver-user' })
+    mockCheckWorkspaceAccess.mockResolvedValue({
+      exists: true,
+      hasAccess: true,
+      canWrite: true,
+      canAdmin: false,
+    })
+    mockGetAccessibleEnvCredentials.mockResolvedValue([])
+    encryptionMockFns.mockDecryptSecret.mockReset()
+  })
+
+  it('decrypts only unique requested accessible values with workspace precedence', async () => {
+    mockGetAccessibleEnvCredentials.mockResolvedValue([
+      {
+        type: 'env_workspace',
+        envKey: 'VISIBLE_SHARED',
+        envOwnerUserId: null,
+        updatedAt: new Date('2026-01-01T00:00:00.000Z'),
+        unredacted: true,
+      },
+      {
+        type: 'env_workspace',
+        envKey: 'HIDDEN_SHARED',
+        envOwnerUserId: null,
+        updatedAt: new Date('2026-01-01T00:00:00.000Z'),
+        unredacted: false,
+      },
+      {
+        type: 'env_workspace',
+        envKey: 'DUPLICATE',
+        envOwnerUserId: null,
+        updatedAt: new Date('2026-01-01T00:00:00.000Z'),
+        unredacted: false,
+      },
+      {
+        type: 'env_workspace',
+        envKey: 'BROKEN',
+        envOwnerUserId: null,
+        updatedAt: new Date('2026-01-01T00:00:00.000Z'),
+        unredacted: false,
+      },
+      {
+        type: 'env_personal',
+        envKey: 'SHARED_PERSONAL',
+        envOwnerUserId: 'owner-2',
+        updatedAt: new Date('2026-01-01T00:00:00.000Z'),
+      },
+    ])
+    queueTableRows(environment, [
+      {
+        variables: {
+          OWN_PERSONAL: 'own-cipher',
+          DUPLICATE: 'personal-shadow-cipher',
+          UNREQUESTED_PERSONAL: 'unrequested-personal-cipher',
+        },
+      },
+    ])
+    queueTableRows(workspaceEnvironment, [
+      {
+        variables: {
+          VISIBLE_SHARED: 'visible-cipher',
+          HIDDEN_SHARED: 'hidden-cipher',
+          DUPLICATE: 'workspace-cipher',
+          BROKEN: 'broken-cipher',
+          INACCESSIBLE: 'inaccessible-cipher',
+          UNREQUESTED_WORKSPACE: 'unrequested-workspace-cipher',
+        },
+      },
+    ])
+    queueTableRows(environment, [
+      { userId: 'owner-2', variables: { SHARED_PERSONAL: 'shared-personal-cipher' } },
+    ])
+    encryptionMockFns.mockDecryptSecret.mockImplementation(async (encryptedValue: string) => {
+      if (encryptedValue === 'broken-cipher') throw new Error('cannot decrypt')
+      return { decrypted: `plain:${encryptedValue}` }
+    })
+
+    await expect(
+      resolveEffectiveEnvironmentVariables('resolver-user', 'workspace-1', [
+        'OWN_PERSONAL',
+        'SHARED_PERSONAL',
+        'VISIBLE_SHARED',
+        'HIDDEN_SHARED',
+        'DUPLICATE',
+        'DUPLICATE',
+        'BROKEN',
+        'MISSING',
+        'INACCESSIBLE',
+        'constructor',
+      ])
+    ).resolves.toEqual({
+      OWN_PERSONAL: {
+        value: 'plain:own-cipher',
+        scope: 'personal',
+        visible: true,
+      },
+      SHARED_PERSONAL: {
+        value: 'plain:shared-personal-cipher',
+        scope: 'personal',
+        visible: false,
+      },
+      VISIBLE_SHARED: {
+        value: 'plain:visible-cipher',
+        scope: 'workspace',
+        visible: true,
+      },
+      HIDDEN_SHARED: {
+        value: 'plain:hidden-cipher',
+        scope: 'workspace',
+        visible: false,
+      },
+      DUPLICATE: {
+        value: 'plain:workspace-cipher',
+        scope: 'workspace',
+        visible: false,
+      },
+    })
+    expect(encryptionMockFns.mockDecryptSecret.mock.calls.map(([value]) => value)).toEqual([
+      'own-cipher',
+      'shared-personal-cipher',
+      'visible-cipher',
+      'hidden-cipher',
+      'workspace-cipher',
+      'broken-cipher',
+    ])
+  })
+
+  it('performs a fresh lookup without reading or warming the snapshot cache', async () => {
+    encryptionMockFns.mockDecryptSecret.mockImplementation(async (encryptedValue: string) => ({
+      decrypted: `plain:${encryptedValue}`,
+    }))
+
+    queueTableRows(environment, [{ variables: { ROTATING: 'first-cipher' } }])
+    queueTableRows(workspaceEnvironment, [{ variables: {} }])
+    await expect(
+      resolveEffectiveEnvironmentVariables('resolver-user', 'workspace-1', ['ROTATING'])
+    ).resolves.toEqual({
+      ROTATING: { value: 'plain:first-cipher', scope: 'personal', visible: true },
+    })
+
+    queueTableRows(environment, [{ variables: { ROTATING: 'snapshot-cipher' } }])
+    queueTableRows(workspaceEnvironment, [{ variables: {} }])
+    await expect(
+      getEffectiveEnvironmentSnapshot('resolver-user', 'workspace-1')
+    ).resolves.toMatchObject({ personalDecrypted: { ROTATING: 'plain:snapshot-cipher' } })
+
+    queueTableRows(environment, [{ variables: { ROTATING: 'fresh-cipher' } }])
+    queueTableRows(workspaceEnvironment, [{ variables: {} }])
+    await expect(
+      resolveEffectiveEnvironmentVariables('resolver-user', 'workspace-1', ['ROTATING'])
+    ).resolves.toEqual({
+      ROTATING: { value: 'plain:fresh-cipher', scope: 'personal', visible: true },
+    })
+
+    await expect(
+      getEffectiveEnvironmentSnapshot('resolver-user', 'workspace-1')
+    ).resolves.toMatchObject({ personalDecrypted: { ROTATING: 'plain:snapshot-cipher' } })
+    expect(encryptionMockFns.mockDecryptSecret).toHaveBeenCalledTimes(3)
+    expect(mockCheckWorkspaceAccess).toHaveBeenCalledTimes(3)
+  })
+})
+
 describe('getPersonalAndWorkspaceEnv access filtering', () => {
   beforeEach(() => {
     vi.clearAllMocks()

apps/sim/lib/environment/utils.ts

@@ -279,6 +279,67 @@ export async function getEffectiveEnvironmentVariableNames(
   ].sort()
 }
 
+export interface ResolvedEnvironmentVariable {
+  value: string
+  scope: 'personal' | 'workspace'
+  visible: boolean
+}
+
+/**
+ * Resolves only the requested environment variables through a fresh ACL-aware lookup.
+ *
+ * This deliberately neither reads nor populates the runtime environment snapshot cache.
+ * Workspace values take precedence over personal values, matching normal resolution. Missing,
+ * inaccessible, and undecryptable values are all omitted so callers cannot distinguish them.
+ */
+export async function resolveEffectiveEnvironmentVariables(
+  userId: string,
+  workspaceId: string | undefined,
+  requestedNames: readonly string[]
+): Promise<Record<string, ResolvedEnvironmentVariable>> {
+  const names = [...new Set(requestedNames)]
+  if (names.length === 0) return {}
+
+  const { personalEncrypted, workspaceEncrypted, personalOwners, workspaceUnredactedKeys } =
+    await loadAccessibleEncryptedEnvironment(userId, workspaceId)
+  const visibleWorkspaceNames = new Set(workspaceUnredactedKeys)
+
+  const resolvedEntries = await Promise.all(
+    names.map(async (name) => {
+      const fromWorkspace = Object.hasOwn(workspaceEncrypted, name)
+      const fromPersonal = Object.hasOwn(personalEncrypted, name)
+      const encrypted = fromWorkspace
+        ? workspaceEncrypted[name]
+        : fromPersonal
+          ? personalEncrypted[name]
+          : undefined
+      if (encrypted === undefined) return null
+
+      try {
+        const { decrypted } = await decryptSecret(encrypted)
+        return [
+          name,
+          {
+            value: decrypted,
+            scope: fromWorkspace ? 'workspace' : 'personal',
+            visible: fromWorkspace
+              ? visibleWorkspaceNames.has(name)
+              : personalOwners[name] === userId,
+          },
+        ] as const
+      } catch {
+        return null
+      }
+    })
+  )
+
+  return Object.fromEntries(
+    resolvedEntries.filter(
+      (entry): entry is readonly [string, ResolvedEnvironmentVariable] => entry !== null
+    )
+  )
+}
+
 export async function getPersonalAndWorkspaceEnv(
   userId: string,
   workspaceId?: string,

apps/sim/lib/selectors/application/execute-selector.test.ts

@@ -170,10 +170,22 @@ describe('executeSelector', () => {
     expect(logged).not.toContain('context')
   })
 
-  it('restores exact detail-id repeats from reference provenance before sanitization', async () => {
+  it.each([
+    {
+      name: 'restores exact detail-id repeats after sanitization',
+      referenceName: 'GOOGLE_FILE_ID',
+      resolvedId: 'resolved-file-id',
+    },
+    {
+      name: 'restores a reference whose spelling overlaps its resolved ID',
+      referenceName: 'ID',
+      resolvedId: 'ID',
+    },
+  ])('$name', async ({ referenceName, resolvedId }) => {
     const { sanitizeSelectorResult } = await vi.importActual<
       typeof import('@/lib/selectors/server/sanitize')
     >('@/lib/selectors/server/sanitize')
+    const originalId = `{{${referenceName}}}`
 
     mocks.resolveScope.mockImplementationOnce(async () => {
       mocks.events.push('canonical-scope')
@@ -188,16 +200,16 @@ describe('executeSelector', () => {
     })
     mocks.resolveReferences.mockImplementationOnce(async ({ protectedValues }) => {
       mocks.events.push('reference-resolution')
-      protectedValues.add('resolved-file-id')
+      protectedValues.add(resolvedId)
       return {
         context: { oauthCredential: 'credential-1' },
-        request: { kind: 'detail', id: 'resolved-file-id' },
+        request: { kind: 'detail', id: resolvedId },
         references: new Map([
           [
             'request.id',
             {
               field: 'request.id',
-              name: 'GOOGLE_FILE_ID',
+              name: referenceName,
               scope: 'workspace',
               visible: false,
             },
@@ -210,38 +222,38 @@ describe('executeSelector', () => {
       return {
         kind: 'detail',
         item: {
-          id: 'resolved-file-id',
-          label: 'resolved-file-id',
-          meta: { resourceId: 'resolved-file-id', mimeType: 'application/pdf' },
+          id: resolvedId,
+          label: resolvedId,
+          meta: { resourceId: resolvedId, mimeType: 'application/pdf' },
         },
       }
     })
-    mocks.sanitize.mockImplementationOnce((result, protectedValues) => {
+    mocks.sanitize.mockImplementationOnce((result, protectedValues, options) => {
       mocks.events.push('sanitization')
       expect(result).toEqual({
         kind: 'detail',
         item: {
-          id: '{{GOOGLE_FILE_ID}}',
-          label: '{{GOOGLE_FILE_ID}}',
-          meta: { resourceId: '{{GOOGLE_FILE_ID}}', mimeType: 'application/pdf' },
+          id: resolvedId,
+          label: resolvedId,
+          meta: { resourceId: resolvedId, mimeType: 'application/pdf' },
         },
       })
-      expect(JSON.stringify(result)).not.toContain('resolved-file-id')
-      expect(protectedValues.contains('resolved-file-id')).toBe(true)
-      return sanitizeSelectorResult(result, protectedValues)
+      expect(protectedValues.contains(resolvedId)).toBe(true)
+      expect(options).toEqual({ allowedDetailExactProtectedValue: resolvedId })
+      return sanitizeSelectorResult(result, protectedValues, options)
     })
 
     await expect(
       execute({
         selectorKey: 'google.drive',
-        request: { kind: 'detail', id: '{{GOOGLE_FILE_ID}}' },
+        request: { kind: 'detail', id: originalId },
       })
     ).resolves.toEqual({
       kind: 'detail',
       item: {
-        id: '{{GOOGLE_FILE_ID}}',
-        label: '{{GOOGLE_FILE_ID}}',
-        meta: { resourceId: '{{GOOGLE_FILE_ID}}', mimeType: 'application/pdf' },
+        id: originalId,
+        label: originalId,
+        meta: { resourceId: originalId, mimeType: 'application/pdf' },
       },
     })
   })